CVE-2021-44515
Zoho Desktop Central Authentication Bypass Vulnerability
Description
CVE-2021-44515 is a critical authentication bypass vulnerability in Zoho ManageEngine Desktop Central that enables remote code execution on the server. The vulnerability allows an unauthenticated attacker to bypass authentication mechanisms and execute arbitrary code on the Desktop Central or Desktop Central MSP server. This Zoho Desktop Central vulnerability was actively exploited in the wild in December 2021 and has been added to CISA's Known Exploited Vulnerabilities catalog. With an EPSS score of 94.36% (99.9th percentile), CVE-2021-44515 has a near-certain probability of exploitation, making immediate patching essential for any organization running affected versions of ManageEngine Desktop Central.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine desktop central | < 10.1.2127.18; >= 10.1.2128.0, < 10.1.2137.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp(Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog(Broken Link, Third Party Advisory, US Government Resource)
- https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html(Exploit, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44515(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper Authentication occurs when software does not sufficiently verify the identity of an actor claiming a given identity. In the case of Zoho ManageEngine Desktop Central, the authentication bypass vulnerability allows remote attackers to circumvent the authentication mechanism entirely, gaining unauthorized access to server functionality that should be restricted to authenticated administrators.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2021-44515 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum-severity threat this vulnerability poses. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially easy for attackers to exploit. Successful exploitation results in high impact across all three security dimensions: attackers can access confidential data managed by Desktop Central, modify system configurations and deploy malicious software, and disrupt the availability of the endpoint management platform. Given that ManageEngine Desktop Central is used to manage and deploy software across enterprise endpoints, a compromise of this system could give attackers control over all managed devices in the organization. The EPSS score of 94.36% confirms that this vulnerability is actively targeted and exploitation is near-certain in exposed environments.
Exploit Maturity
CVE-2021-44515 is confirmed as actively exploited in the wild, as documented by its inclusion in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2021-12-24. Public exploit information is available via the ManageEngine security advisory, which includes technical details about the authentication bypass and patch guidance. The EPSS score of 94.36% (99.9th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively targeted CVEs. Organizations with internet-facing Desktop Central instances are at particularly high risk and should treat remediation as an emergency priority.
Remediation
- Apply vendor patches immediately as required by CISA KEV: upgrade Enterprise builds 10.1.2127.17 and earlier to 10.1.2127.18, and Enterprise builds 10.1.2128.0 through 10.1.2137.2 to 10.1.2137.3. The same version guidance applies to MSP builds.
- Verify that all ManageEngine Desktop Central instances, including both Enterprise and MSP variants, have been updated by checking the build number in the Desktop Central admin console.
- Restrict network access to the Desktop Central web interface using firewall rules, ensuring only authorized administrator IP addresses can reach the management port. Do not expose Desktop Central directly to the internet.
- Review server logs and system audit trails for indicators of compromise, including unauthorized login attempts, unexpected agent deployments, or suspicious script executions that occurred before patching.
- Implement multi-factor authentication for all administrative access to Desktop Central and conduct a thorough review of all accounts, deployed configurations, and software packages to ensure no persistent backdoors were installed.
Technical Details
CVE-2021-44515 is an authentication bypass vulnerability in Zoho ManageEngine Desktop Central that allows unauthenticated remote code execution. The flaw resides in the authentication filter configuration of the Desktop Central server, where certain request paths are not properly validated against authentication requirements. An attacker can craft requests that bypass the authentication mechanism entirely, gaining access to administrative functionality without providing valid credentials. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is a network-accessible vulnerability with low attack complexity, no privilege requirements, and no user interaction needed, resulting in complete compromise of confidentiality, integrity, and availability of the Desktop Central server.
Frequently Asked Questions
Is CVE-2021-44515 being actively exploited?
Yes. CVE-2021-44515 was actively exploited in the wild in December 2021 and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.36% (99.9th percentile) indicates near-certain exploitation activity in exposed environments.
What products are affected by CVE-2021-44515?
CVE-2021-44515 affects Zoho ManageEngine Desktop Central. Specifically, Enterprise builds 10.1.2127.17 and earlier, Enterprise builds 10.1.2128.0 through 10.1.2137.2, and the corresponding MSP builds at the same version ranges are vulnerable.
How do I fix CVE-2021-44515?
Upgrade to ManageEngine Desktop Central build 10.1.2127.18 (for builds 10.1.2127.17 and earlier) or 10.1.2137.3 (for builds 10.1.2128.0 through 10.1.2137.2). This applies to both Enterprise and MSP variants. Additionally, restrict network access to the Desktop Central web interface.
How severe is CVE-2021-44515?
CVE-2021-44515 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. It allows unauthenticated remote code execution and is actively exploited, making it one of the most urgent vulnerabilities to remediate in ManageEngine Desktop Central deployments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.